Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to do some port redirection on linux for IPv6 alongside the IPv4 redirection?

The point is to make all the various services — that are running on separate hosts / virtual systems — available on as well as (which pretty much works that way anyway with iptables prerouting for IPv4).

In a perfect case this would be something like ICMP message “for this port on this host connect to that host”, but I don't know if that's possible in IPv6.

share|improve this question
either ip6tables or a ipv6 to ipv4 tunnelled interface will do what you want i think. I've not used ipv6 yet myself much. – Sirex Jan 10 '12 at 8:02
Hm. Tunneling stuff that goes to these ports to the main host into IPv4 of the same host might do that; though it seems to me like a bit of overcomplication (I hope there's a more appropriate solution). And ip6tables isn't really helpful here (see for example). – HoverHell Jan 10 '12 at 11:49
Can you describe how you do it in ipv4? What is this ICMP message that you mention? – becomingwisest Jan 10 '12 at 17:08
In IPv4 I, of course, use nat-prerouting + DNAT, since I only have one IPv4 address. And the ICMP redirect I mention is something like — though it doesn't work port-wise and isn't always supported anyway. – HoverHell Jan 11 '12 at 4:54
how about an xinetd redirect ? – Sirex Jan 11 '12 at 13:48
up vote 1 down vote accepted

Let me rephrase your question as an example to make sure I've understood it correctly.

You have various services, let's say HTTP, IMAP, LDAP, etc... and you want them all to be reachable by connecting to "" (no subdomain). But those services aren't all on the same host. It would be better if the clients used subdomains like "", "", and so on because then you could just map those names in DNS to the appropriate address, but they aren't going to do that (at least some of the time), they're going to use plain "". So whatever host answers at "" is going to have to dispatch requests to the actual host that handles each service.

You can use a plain TCP forwarder, like an xinetd redirect as Sirex suggests, but with that comes all the usual problems of TCP forwarders: on the host that services the request the IP connection appears to come from the forwarding server, not the original client, so the logs and other things end up wrong.

Application-level proxy servers (reverse proxy) are also an option for those protocols that have them. But you really actually wanted to send the whole TCP/UDP connection to the other server, not introduce a proxy server. Right.

Well, now that Linux supports DNAT for IPv6 you probably want to just use that.

Alternatively, if you are using some kind of hardware load balancer, that can probably do the job for you.

The better alternative would have been DNS SRV records. Those allow clients to look up not just a hostname in the DNS but a hostname + service name together, and get back a raw hostname or IP address plus a port number where they can connect. That allows you to map "" for HTTP to one IP address and "" for LDAP to a different IP address.

Unfortunately, though the SRV record standard is more than 15 years old, it never got much takeup, and clients just don't use it. So it's not an option. Actually, it is frequently used together with a select few protocols like SIP, but virtually all web browsers and IMAP clients and clients for most other protocols completely ignore it.

share|improve this answer
Aha! Thanks for the detailed overview. Also interesting, what are reasonable timeline expectations regarding the inclusion of the linked patch into the mainline kernel? (aside from couple months of it getting into stable kernel and year more or so of it getting into debian stable :) ). – HoverHell Jan 12 '12 at 2:34
There are never any reasonable timeline expectations regarding Debian stable :-) But seriously, I haven't been following it, so I don't know. – Celada Jan 12 '12 at 3:40
Debian stable is a year or two, but I'm asking about mainline kernel in general. – HoverHell Jan 12 '12 at 6:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.